How exploitable the technique is depends on what an attacker can influence and what the agent is allowed to do, he added. A read-only agent poses a different risk from one that can reach confidential files, change code repositories, or run commands.
Because an attacker can dictate the arguments that reach a tool, the researchers argued that tools must validate their own inputs. They built ToFu, a fuzzing framework that reads each tool’s description and checks whether the tool enforces the limits it advertises, such as staying inside a designated folder.
After manual review, they confirmed 253 bugs affecting 343 tools across 118 servers. The most serious were 64 path-traversal flaws, seven server-side request forgery (SSRF) flaws, five data-exfiltration bugs, and three OS command-injection flaws. Most of the rest were reflected-output and log-injection issues, which the paper rates as lower impact in many deployments.
